I had! Further scrutiney is this: Either the perps were so stupid as to not hide their IP (doubtful) or so arrogant they thought it wouldn't matter (again doubtful, considering Hillary lost the last election). Or as you said, spoofing was involved. But that too seems fishy... because they used masks still pointed to China and Iran. Or last, the entire set up was a fraud (again unlikely).

My guess is the infrastructure in place must have been smart enough to decipher the inbound masking to determine the actual origin. Is that possible? I don't know. Any techs out there?